0948a6e361d814ee7a34088f0a898706aea84359ec60740258176cfbbbef947c

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 22:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0948a6e361d814ee7a34088f0a898706aea84359ec60740258176cfbbbef947c_NeikiAnalytics.exe
Size

9.2MB
MD5

3827d850535d0e7370e5963ba189a250
SHA1

4a7052caef6165a2e42d986bf5a3f87e6c307ba9
SHA256

0948a6e361d814ee7a34088f0a898706aea84359ec60740258176cfbbbef947c
SHA512

ed8ac09379e9dd37504ba44721688230fe00b7ed3fc5da7daf063b2beda8899f5b384e746e5fa6f3106c3701e8a99f3a6c360d023706a9d07f9b9f5f39f6832f
SSDEEP

196608:gDIY29OuiQYmmfJVcyxIMcMrHKVMEvKs7DGlAi9Q3QRr+jup:7Y29OPmOJVcyxIMcMT+mAQ8rjup

Score

7^/10

upx vmprotect

Malware Config

Signatures

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1912-63-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1912-61-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1912-59-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1912-57-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1912-55-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1912-53-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1912-51-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1912-49-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1912-47-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1912-45-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1912-43-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1912-41-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1912-40-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1912-39-0x0000000010000000-0x000000001003E000-memory.dmp	upx

VMProtect packed file 17 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/1912-82-0x0000000000400000-0x0000000001B83000-memory.dmp	vmprotect
behavioral1/memory/1912-36-0x0000000000400000-0x0000000001B83000-memory.dmp	vmprotect
behavioral1/memory/1912-126-0x0000000000400000-0x0000000001B83000-memory.dmp	vmprotect
behavioral1/memory/1912-127-0x0000000000400000-0x0000000001B83000-memory.dmp	vmprotect
behavioral1/memory/1912-128-0x0000000000400000-0x0000000001B83000-memory.dmp	vmprotect
behavioral1/memory/1912-129-0x0000000000400000-0x0000000001B83000-memory.dmp	vmprotect
behavioral1/memory/1912-130-0x0000000000400000-0x0000000001B83000-memory.dmp	vmprotect
behavioral1/memory/1912-131-0x0000000000400000-0x0000000001B83000-memory.dmp	vmprotect
behavioral1/memory/1912-132-0x0000000000400000-0x0000000001B83000-memory.dmp	vmprotect
behavioral1/memory/1912-133-0x0000000000400000-0x0000000001B83000-memory.dmp	vmprotect
behavioral1/memory/1912-134-0x0000000000400000-0x0000000001B83000-memory.dmp	vmprotect
behavioral1/memory/1912-135-0x0000000000400000-0x0000000001B83000-memory.dmp	vmprotect
behavioral1/memory/1912-136-0x0000000000400000-0x0000000001B83000-memory.dmp	vmprotect
behavioral1/memory/1912-138-0x0000000000400000-0x0000000001B83000-memory.dmp	vmprotect
behavioral1/memory/1912-139-0x0000000000400000-0x0000000001B83000-memory.dmp	vmprotect
behavioral1/memory/1912-140-0x0000000000400000-0x0000000001B83000-memory.dmp	vmprotect
behavioral1/memory/1912-141-0x0000000000400000-0x0000000001B83000-memory.dmp	vmprotect

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1912	0948a6e361d814ee7a34088f0a898706aea84359ec60740258176cfbbbef947c_NeikiAnalytics.exe
1912	0948a6e361d814ee7a34088f0a898706aea84359ec60740258176cfbbbef947c_NeikiAnalytics.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1912	0948a6e361d814ee7a34088f0a898706aea84359ec60740258176cfbbbef947c_NeikiAnalytics.exe
1912	0948a6e361d814ee7a34088f0a898706aea84359ec60740258176cfbbbef947c_NeikiAnalytics.exe
1912	0948a6e361d814ee7a34088f0a898706aea84359ec60740258176cfbbbef947c_NeikiAnalytics.exe
1912	0948a6e361d814ee7a34088f0a898706aea84359ec60740258176cfbbbef947c_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\0948a6e361d814ee7a34088f0a898706aea84359ec60740258176cfbbbef947c_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0948a6e361d814ee7a34088f0a898706aea84359ec60740258176cfbbbef947c_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1912-29-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/1912-34-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/1912-32-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/1912-82-0x0000000000400000-0x0000000001B83000-memory.dmp

Filesize
23.5MB

Download
memory/1912-63-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1912-61-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1912-59-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1912-57-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1912-55-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1912-53-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1912-51-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1912-49-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1912-47-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1912-45-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1912-43-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1912-41-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1912-40-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1912-39-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1912-30-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/1912-27-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/1912-24-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/1912-22-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/1912-19-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/1912-17-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/1912-14-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/1912-12-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/1912-9-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/1912-7-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/1912-5-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/1912-4-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/1912-2-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/1912-0-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/1912-36-0x0000000000400000-0x0000000001B83000-memory.dmp

Filesize
23.5MB

Download
memory/1912-37-0x0000000000CD3000-0x0000000001259000-memory.dmp

Filesize
5.5MB

Download
memory/1912-126-0x0000000000400000-0x0000000001B83000-memory.dmp

Filesize
23.5MB

Download
memory/1912-127-0x0000000000400000-0x0000000001B83000-memory.dmp

Filesize
23.5MB

Download
memory/1912-128-0x0000000000400000-0x0000000001B83000-memory.dmp

Filesize
23.5MB

Download
memory/1912-129-0x0000000000400000-0x0000000001B83000-memory.dmp

Filesize
23.5MB

Download
memory/1912-130-0x0000000000400000-0x0000000001B83000-memory.dmp

Filesize
23.5MB

Download
memory/1912-131-0x0000000000400000-0x0000000001B83000-memory.dmp

Filesize
23.5MB

Download
memory/1912-132-0x0000000000400000-0x0000000001B83000-memory.dmp

Filesize
23.5MB

Download
memory/1912-133-0x0000000000400000-0x0000000001B83000-memory.dmp

Filesize
23.5MB

Download
memory/1912-134-0x0000000000400000-0x0000000001B83000-memory.dmp

Filesize
23.5MB

Download
memory/1912-135-0x0000000000400000-0x0000000001B83000-memory.dmp

Filesize
23.5MB

Download
memory/1912-136-0x0000000000400000-0x0000000001B83000-memory.dmp

Filesize
23.5MB

Download
memory/1912-137-0x0000000000CD3000-0x0000000001259000-memory.dmp

Filesize
5.5MB

Download
memory/1912-138-0x0000000000400000-0x0000000001B83000-memory.dmp

Filesize
23.5MB

Download
memory/1912-139-0x0000000000400000-0x0000000001B83000-memory.dmp

Filesize
23.5MB

Download
memory/1912-140-0x0000000000400000-0x0000000001B83000-memory.dmp

Filesize
23.5MB

Download
memory/1912-141-0x0000000000400000-0x0000000001B83000-memory.dmp

Filesize
23.5MB

Download